[pull] main from openai:main

codex-rs/Cargo.toml

@@ -446,7 +446,8 @@ regex-automata = { version = "0.4.13", default-features = false, features = ["st
 regex-lite = "0.1.8"
 regex-syntax = "0.8.8"
 reqwest = { version = "0.12", features = ["cookies"] }
-rmcp = { version = "=3.2.0", default-features = false }
+# rmcp-v3.3.0 includes enterprise authorization helpers (rust-sdk#1234).
+rmcp = { git = "https://github.com/modelcontextprotocol/rust-sdk", rev = "3e636cab26c013eca5131103c03d20237f12c4df", version = "=3.3.0", default-features = false }
 runfiles = { git = "https://github.com/dzbarsky/rules_rust", rev = "b56cbaa8465e74127f1ea216f813cd377295ad81" }
 rustix = { version = "1.1.4", features = ["net"] }
 rustls = { version = "0.23.45", default-features = false, features = [

codex-rs/analytics/src/client_tests.rs

@@ -1075,3 +1075,111 @@ fn track_event_request_batches_only_isolates_accepted_line_fingerprint_events()
     assert!(batches[1][0].should_send_in_isolated_request());
     assert!(batches[2][0].should_send_in_isolated_request());
 }
+
+#[cfg(debug_assertions)]
+#[tokio::test]
+async fn account_switch_between_batches_does_not_send_old_credentials() {
+    use codex_http_client::DestinationPolicy;
+    use codex_http_client::NetworkPolicyController;
+    use codex_login::AuthCredentialsStoreMode as Store;
+    use tokio::io::AsyncReadExt;
+    use tokio::io::AsyncWriteExt;
+
+    let home = unique_capture_path("batch-account-switch");
+    fs::create_dir_all(&home).unwrap();
+    let mut stored: codex_login::AuthDotJson = serde_json::from_value(serde_json::json!({
+        "auth_mode": "chatgptAuthTokens",
+        "tokens": {
+            "id_token": "e30.e30.sig",
+            "access_token": "test-access-token-a",
+            "refresh_token": "",
+            "account_id": "account-a",
+        },
+    }))
+    .unwrap();
+    stored.last_refresh = Some(SystemTime::now().into());
+    codex_login::save_auth(&home, &stored, Store::File, Default::default()).unwrap();
+    let controller = NetworkPolicyController::default();
+    let policy = controller.policy();
+    let manager = Arc::new(
+        codex_login::AuthManager::new(
+            home.clone(),
+            /*enable_codex_api_key_env*/ false,
+            Store::File,
+            /*forced_chatgpt_workspace_id*/ None,
+            /*chatgpt_base_url*/ None,
+            Default::default(),
+            codex_login::AuthRouteConfig::from_http_client_factory(
+                HttpClientFactory::new(OutboundProxyPolicy::ReqwestDefault)
+                    .with_network_policy(policy.clone()),
+            ),
+        )
+        .await,
+    );
+    assert!(controller.publish(policy.revision(), DestinationPolicy::Unrestricted));
+    let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
+    let destination = AnalyticsEventsDestination::Http {
+        url: format!("http://{}/events", listener.local_addr().unwrap()),
+    };
+    let requests = Arc::new(Mutex::new(Vec::new()));
+    let captured = Arc::clone(&requests);
+    let server_manager = Arc::clone(&manager);
+    let server_home = home.clone();
+    let server = tokio::spawn(async move {
+        loop {
+            let (mut stream, _) = listener.accept().await.unwrap();
+            let mut request = Vec::new();
+            loop {
+                let mut buffer = [0; 4096];
+                let count = stream.read(&mut buffer).await.unwrap();
+                assert!(count > 0);
+                request.extend_from_slice(&buffer[..count]);
+                if let Some(end) = request.windows(4).position(|part| part == b"\r\n\r\n") {
+                    let headers = String::from_utf8_lossy(&request[..end]).to_lowercase();
+                    let length: usize = headers
+                        .lines()
+                        .find_map(|line| line.strip_prefix("content-length: "))
+                        .unwrap()
+                        .parse()
+                        .unwrap();
+                    if request.len() >= end + 4 + length {
+                        break;
+                    }
+                }
+            }
+            let first = {
+                let mut requests = captured.lock().unwrap();
+                requests.push(String::from_utf8(request).unwrap());
+                requests.len() == 1
+            };
+            if first {
+                let tokens = stored.tokens.as_mut().unwrap();
+                tokens.account_id = Some("account-b".to_string());
+                tokens.access_token = "test-access-token-b".to_string();
+                codex_login::save_auth(&server_home, &stored, Store::File, Default::default())
+                    .unwrap();
+                server_manager.reload().await;
+                assert!(controller.publish(policy.revision(), DestinationPolicy::Unrestricted));
+            }
+            let _ = stream
+                .write_all(b"HTTP/1.1 200 OK\r\nContent-Length: 0\r\nConnection: close\r\n\r\n")
+                .await;
+        }
+    });
+    let events = vec![
+        sample_accepted_line_fingerprint_event("one"),
+        sample_accepted_line_fingerprint_event("two"),
+    ];
+    send_track_events(&manager, &destination, events, &ThreadProducts::default()).await;
+    server.abort();
+    let _ = server.await;
+    let requests = requests.lock().unwrap();
+    assert_eq!(requests.len(), 1);
+    assert!(
+        requests[0]
+            .to_lowercase()
+            .contains("chatgpt-account-id: account-a")
+    );
+    assert!(requests[0].contains("test-access-token-a"));
+    fs::remove_dir_all(home).unwrap();
+}